Buildah — The Cyber Toolchain

Buildah v1.46.0

Wed, 21 Oct 2026 14:43:03 GMT

Buildah v1.46.0 adds --umask, --keep-git-dir, --include, --required-path flags and CDI visibility to buildah info⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--umask` flag to `buildah run` to set the umask for the container process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Implements `--keep-git-dir` flag on `buildah add` (ADD instruction) for Docker-compatible preservation of the `.git` directory when adding a Git source. • Adds `--include` flag to `buildah add` and `buildah copy` to filter which files are copied from a source. • Adds `--required-path` flag to `buildah add` and `buildah copy` to require that a specific path exists in the source. • Improves Git source handling in `buildah add` by adding `--checksum` verification against the resolved commit and enabling build cache hits for repeated Git URL adds. • Adds `sharing=private` support for cache mounts in `RUN --mount=type=cache`. • Honors `http_proxy` and proxy environment settings from `containers.conf` during image builds. • Enables `--log-level error` or `--log-level fatal` to silence Containerfile step output during builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.45.0

Thu, 30 Jul 2026 17:44:23 GMT

Buildah v1.45.0 adds --no-follow-symlinks for COPY/ADD, --timestamp for manifest push, symbolic chmod support, and new SFTP/SSHFS CLI commands. • Adds `--no-follow-symlinks` flag to `buildah add` and `buildah copy` to copy symlinks themselves rather than their targets. • Adds `--timestamp` flag to `buildah manifest push` to set timestamps on new manifest content to a fixed epoch-relative value for reproducible builds. • Adds support for symbolic chmod options (e.g. `u+x`, `go-w`) in `buildah add` and `buildah copy` `--chmod`. • Adds Copier.Symlink() API for creating symlinks with inline targets. • Adds `CreateDestPath` option to copier `PutOptions` to automatically create destination paths. • Adds `PutOptions.Timestamp` to the copier API for per-operation timestamp overrides. • Buildah now honors the `seccomp_profile` setting from `containers.conf` when parsing build options. • Rejects `--security-opt seccomp=profile` explicitly when seccomp support is unavailable, rather than silently ignoring it. • Restores support for `FROM containers-storage:` prefixes in Containerfiles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.44.0

Wed, 27 May 2026 21:40:35 GMT

Buildah v1.44.0 adds --metadata-file, --iidfile-raw, --mount, --source-policy-file, Windows image support, and more. • Adds `--metadata-file` flag to `buildah commit` (via new CommitResults() API) to write commit metadata to a file. • Adds `--iidfile-raw` CLI option to `buildah build` for writing the raw image ID to a file. • Adds `--mount` option to `buildah build` for specifying mounts at build time on the CLI. • Adds support for `--mount=type=secret,id=foo,env=bar` to expose secrets via environment variables during builds. • Adds `--source-policy-file` flag for BuildKit-compatible source policies in `buildah build`. • Adds `FROM --after` flag support for declaring explicit stage dependencies in Dockerfiles. • Enables building Windows container images. • Adds `--amend` and `--replace` flags to `manifest create` for handling non-list images. • Adds `RunOptions.ValidExitCodes` and `--valid-exit-codes` flag to `buildah run` for specifying acceptable exit codes. • Adds support for preserving and labeling intermediate stage images during multi-stage builds. • Makes `COPY --exclude` patterns context-relative. • Respects `compression_format` from `containers.conf` in `push`, `build --cache-to`, and `commit`. • Ignores `.containerignore` for git repositories in `ADD` instructions. • Removes Cgroups v1 support. • Removes CNI networking support. • Removes slirp networking support. • Groups global commands in global help output for improved CLI discoverability. • Introduces deterministic network ordering. • Changes Configuration File lookup behavior; callers reading config files should refer to the updated containers-config(5) specification. Breaking changes: • Cgroups v1 support has been removed; setups relying on cgroupsv1 will no longer work. • CNI networking support has been removed; setups using CNI will break on upgrade. • slirp networking support has been removed; setups relying on slirp will break on upgrade. • Configuration File lookup behavior has changed; callers of functions that read configuration files must refer to containers-config(5) for updated details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.42.0

Wed, 22 Oct 2025 15:18:44 GMT

Buildah v1.42.0 adds --imagestore and --transient-store global flags, corporate proxy support, and Sequoia crypto backend integration. • Adds `--imagestore` global flag to specify an alternate image store. • Adds `--transient-store` global option for ephemeral storage configurations. • Adds corporate proxy support for `build` and `add` subcommands. • Includes the Sequoia crypto backend with integration test coverage. • Image history now records `unset-label`, `timestamp`, and `rewrite-timestamp` operations. • `--mount=type=bind` ignores `modTime` when evaluating cache candidates, improving cache hit rates. • `commit` always returns the config digest as the image ID. • `chroot` uses `$PATH` when locating commands during builds. Breaking changes: • The default meaning of `--pull` is restored to `always`; setups relying on the previous changed default may pull images unexpectedly on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.41.0

Mon, 21 Jul 2025 13:48:11 GMT

Buildah v1.41.0 adds reproducible-build timestamp controls, --output multi-use, --unsetannotation, --inherit-annotations, ADD/COPY --link, and zstd commit compression. • Adds `--timestamp` flag to `buildah add` for setting file timestamps when adding content. • Adds `--source-date-epoch` and `--rewrite-timestamp` flags to `buildah commit` and `buildah build` for reproducible image builds. • Allows `--output` to be specified multiple times in `buildah build`, enabling simultaneous export to multiple destinations. • Adds `--unsetannotation` flag to `buildah build` and `buildah config` for removing specific OCI/Docker image annotations. • Adds `--inherit-annotations` flag to `buildah build` for propagating annotations from base images. • Supports `ADD`/`COPY` `--link` instruction in Dockerfiles, enabling efficient layer composition without cache invalidation. • Supports zstd compression when committing images with `buildah commit`. • Accepts `SOURCE_DATE_EPOCH` as a build-arg in Dockerfile builds for reproducibility. • Adds `label_users` support, enabling user label mapping in container builds. • Supports `host-gateway` as a valid value in `--add-host` / `--extra-hosts` format. • Sets the OCI `org.opencontainers.image.created` annotation on OCI images at commit/build time. • Cache selection now prefers the most recent layer when conflicts arise during image builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.40.0

Mon, 21 Apr 2025 17:42:45 GMT

Buildah v1.40.0 adds --parents for COPY, --inherit-labels for build, cache-mount ownership distinctions, and containers.conf hostname support. • Adds `--parents` option for `COPY` in Containerfiles, preserving source directory structure in the destination. • Adds `--inherit-labels` flag to `buildah build` for inheriting labels from base images. • Distinguishes `--mount=type=cache` locations by ownership in addition to other attributes, enabling safer concurrent cache sharing. • Supports the `containers.conf` `container_name_as_hostname` option for controlling container hostname behavior. • Uses `HistoryTimestamp`, when set, for OCI-archive entry timestamps, enabling reproducible archive metadata. • Masks thermal paths in the container runtime environment. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.39.0

Mon, 03 Feb 2025 16:28:59 GMT

Buildah v1.39.0 adds artifact annotations, security-opt mask/unmask, image-name cache mounts, and --no-pivot-root support. • Adds `--artifact-annotation` flag to `manifest add` for annotating OCI artifact manifests. • Adds `--security-opt mask` and `--security-opt unmask` support to control path masking during builds. • Adds `--no-pivot-root` flag to the executor for environments where pivot_root is unavailable or undesirable. • Allows cache mounts (`--mount=type=cache`) to reference build stages and additional build contexts as sources. • Accepts image names as sources for cache mounts, enabling pre-populated cache layers from existing images. • Records the hash or digest of images used in `--mount` into the image build history for improved reproducibility auditing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.38.0

Mon, 11 Nov 2024 15:26:41 GMT

Buildah v1.38.0 adds git source support for ADD, COPY/ADD --exclude, and makes manifest push --all the default. • Adds git repository sources to the `add` command, enabling direct ADD from git URLs in Dockerfiles and CLI. • Adds `--exclude` option to both `COPY` and `ADD` instructions for filtering files during build. • Makes `buildah manifest push --all` default to true, pushing all platform variants without an explicit flag. • Adds `CertPath`, `InsecureSkipTLSVerify`, and `Retry` fields to `AddAndCopyOptions` in the Go library API. • Adds `PrependedLinkedLayers` and `AppendedLinkedLayers` to `CommitOptions` in the Go library API. • Adds support for globbing with `**` path components in the copier. • Enables handling of `RUN --mount` with relative targets when no workdir is configured. • Supports registering `binfmt_misc` when running inside a container, improving cross-platform build support. • Handles multiple values for `manifest add --artifact` flag. Breaking changes: • `buildah manifest push --all` now defaults to true; setups that relied on the flag being opt-in will push all manifest list entries on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.37.0

Fri, 26 Jul 2024 17:52:15 GMT

Buildah v1.37.0 adds healthcheck --start-interval, custom cache lookup, NetBSD support, and owner-preserving copy. • Adds `--start-interval` flag to healthcheck configuration for fine-grained startup probe timing. • Supports custom image reference lookup functions for cache push/pull in `imagebuildah`. • Adds initial NetBSD platform support. • Preserves owner info when using `buildah copy --from=` a container or image. • Changes default pull behavior for `podman build` to `--pull missing`. Breaking changes: • The default for `podman build` is changed to `--pull missing` (previously pulled always); existing workflows that relied on always pulling fresh images will now use cached images when present. • `imagebuildah` no longer uses traditional volume handling by default; builds relying on the previous volume behavior may behave differently without explicit configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.36.0

Thu, 23 May 2024 23:55:51 GMT

Buildah v1.36 adds --digestfile to source-push and --device CDI spec support. • Adds `--digestfile` flag to `buildah source-push` for writing image digests • Adds support for passing CDI specs to `--device` in `buildah bud` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.35.0

Thu, 07 Mar 2024 12:38:08 GMT

Buildah v1.35.0 adds --sbom to commit, artifact flags to manifest add, and retry logic for manifest push. • commit: add a --sbom flag to scan and produce SBOMs when committing • manifest, push: add support for `--retry` and `--retry-delay` • buildah manifest: add artifact-related options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.34.0

Wed, 13 Dec 2023 15:28:19 GMT

Buildah v1.34.0 adds FreeBSD jail support for build containers • Adds the ability to use a single FreeBSD jail for container operations via `buildah run` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.33.0

Fri, 17 Nov 2023 22:33:23 GMT

Buildah v1.33.0 adds --unsetlabel, --no-hostname, ADD --checksum, heredoc support, and OverrideChanges to CommitOptions • Adds `--unsetlabel` flag to `buildah config` to remove image labels during build configuration. • Adds `--no-hostname` option to `buildah containers` to prevent setting the hostname in the container. • Adds `--checksum` flag to `ADD` instructions (in Dockerfiles) to verify source file integrity. • Enables heredoc support for `RUN`, `COPY`, and `ADD` instructions in Dockerfiles. • Adds `OverrideChanges` and `OverrideConfig` fields to `CommitOptions` in the Go API to modify container state at commit time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.32.0

Thu, 14 Sep 2023 19:03:34 GMT

Buildah v1.32 adds `--layer-label`, `--force-compression` and support for passing ULimits as -1. • Adds `--layer-label` flag to `buildah build` to set labels on intermediate image layers • Adds `--force-compression` flag to `buildah push` and `manifest-push` to prevent blob reuse during compression • Supports passing ULimits as `-1` to mean maximum value Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.31.0

Fri, 30 Jun 2023 21:07:50 GMT

Adds --secret required flag support, pasta/slirp4netns network options, and containers.conf temp dir hook • `buildah build` and `buildah run` now accept the `--secret` flag without a value to require a secret by name. • Adds support for `pasta` and `slirp4netns` network backends via the `default_rootless_network_cmd` config key in `containers.conf`. • `GetTempDir` now honors the `image_copy_tmp_dir` setting from `containers.conf` to control temporary storage paths for image operations. Breaking changes: • Removed device mapper support entirely. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.30.0

Sat, 08 Apr 2023 21:42:35 GMT

Buildah v1.30.0 adds --build-arg-file for loading build args from files and inline `--network` support in RUN statements. • Accept arguments from file with `--build-arg-file` • Expose public `CleanCacheMount` API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.29.0

Thu, 26 Jan 2023 15:08:25 GMT

Buildah v1.29 introduces `buildah prune`, remote-cache multi-source/dest support, relative mountpoints, and --group-add. • `buildah prune` subcommand and exposed `CleanCacheMount` API to clean build caches • `remote-cache` supports multiple sources and destinations for pull/push operations • `--group-add` flag added to `buildah from` command • `--mount=type=cache` sets separate cache parent on host for each user • `buildah build` adds support for `--pull=missing` • Relative mountpoints allowed with respect to work directory via `--mount` and `--secret` flags • `no-new-privileges` flag added to control privilege escalation during builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.28.0

Mon, 03 Oct 2022 14:12:23 GMT

Buildah v1.28 adds `manifest create --amend`, `manifest exists`, `--retry`/`--retry-delay`, `chroot` isolation, and `--skip-unused-stages`. • Adds `--retry` and `--retry-delay` flags to `buildah push` and `buildah pull` for automatic retry on transient failures. • Adds `buildah manifest create --amend` flag to update existing manifests without removing existing references. • Adds `buildah manifest exists` command to check if a manifest list exists in the local store or remote registry. • Adds `--skip-unused-stages` flag to `buildah bud` for multi-stage builds to skip stages not referenced by subsequent stages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.23.5

Wed, 21 Sep 2022 12:45:56 GMT

Buildah v1.23.5 adds support for additional GIDs in `buildah run` • `buildah run` now accepts the `--gid` flag to specify supplementary group IDs for the container process. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.27.2

Tue, 20 Sep 2022 18:49:31 GMT

Adds --skip-unused-stages flag to buildah build for multi-stage builds • Adds `--skip-unused-stages` flag to `buildah build` to exclude unused stages from multi-stage builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.27.0

Tue, 09 Aug 2022 01:39:03 GMT

Buildah v1.27.0 adds cache TTL, remote cache distribution, and FreeBSD support • Adds `--cache-ttl` to filter build cache by duration • Supports distributing cache to remote sources using `--cache-to` and `--cache-from` • Adds initial support for building images on FreeBSD • Supports OCI hooks for ephemeral build containers • Adds `--userns=auto` for automatic user namespace mapping • Allows disabling image history with `--omit-history` in the commit command • Supports splitting build logs by platform using `--logsplit` in multiarch builds • Adds `--build-context` option to specify additional build contexts • Adds `-cpp-flag` to pass C Preprocessor flags during Containerfile processing • Shows a progress bar while pushing and pulling images Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.26.4

Wed, 03 Aug 2022 18:57:07 GMT

Buildah v1.26.4 adds flags for C preprocessor, build context, log splitting, and image history to `buildah build`. • Adds the `--cpp-flag` option to `buildah build` for passing additional arguments to the C preprocessor • Adds the `--build-context` flag to `buildah build` for accessing additional build content in COPY and RUN instructions • Adds the `--omit-history` flag to `buildah build` to prevent adding history entries to newly built images • Adds the `--logsplit` flag to `buildah build` for splitting build logs among multiple files when building for multiple platforms • Adds the `NoOverwriteDirNonDir` option to the buildah copier API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah 1.29.0

Mon, 09 May 2022 00:00:00 GMT

Buildah 1.29.0 adds prune command, --group-add support, and multi-source caching to build • Adds the `prune` subcommand to clean intermediate images, build cache, and mount cache. • Adds `--group-add` option to the `from` and `build` commands for assigning additional groups. • Allows multiple sources/destinations via `--cache-from` and `--cache-to` options on the `build` command. • Adds support for the `--security-opt no-new-privileges` flag in the `build` command. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.26.0

Wed, 04 May 2022 18:13:49 GMT

Buildah v1.26.0 adds --output for custom build outputs and --env for environment injection. • `buildah build` now supports `--output` to specify a custom build output destination • `buildah build` adds `--env` flag to inject environment variables into the build context Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.25.1

Wed, 30 Mar 2022 17:47:18 GMT

Buildah v1.25.1 adds `--no-cache` and `--layers` flags to override build caching • `buildah build` now accepts `--no-cache` and `--layers` flags to bypass or force layer usage in the build cache. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.25.0

Tue, 29 Mar 2022 14:16:33 GMT

Buildah v1.25.0 adds --no-hosts flag for container isolation and buildkit cache locking • Adds `--no-hosts` flag to `buildah bud` to eliminate use of `/etc/hosts` within containers • Adds external cache store locking support for buildkit `mount=type=cache` builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.24.1

Thu, 03 Feb 2022 23:27:01 GMT

Buildah v1.24.1 adds `FROM --platform=` support inside multi-stage builds • Adds inline `FROM --platform=` support within Containerfile/Dockerfile for multi-stage builds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah

Buildah v1.24.0

Thu, 27 Jan 2022 00:19:54 GMT

Buildah v1.24 adds --mount types for tmpfs/cache, --all-platforms, secret env sources, and variant support. • `buildah bud --all-platforms` builds multi-arch images in a single invocation • `--mount=type=tmpfs` allows volatile memory mounts in BuildKit-compatible Containerfiles • `--mount=type=cache` enables persistent caching across build stages • Support `env://SECRET_NAME` syntax for reading secrets from environment variables • `config: variant` field now supported in manifest configuration • `--unsetenv ` removes specified environment variables from the built image Full history on Cyber Toolchain: https://cybertoolchain.io/tools/buildah